Booking-related information for customers of South Korea's Korean Air and Asiana Airlines was exposed externally in a security incident at Amadeus IT Group, the global aviation IT systems operator both carriers use jointly. The two airlines said no evidence has been confirmed of direct intrusion into their internal databases (DBs), but the scale of the leak and the specific data categories remain unknown, leaving open the possibility that the damage could widen.
Korean Air (003490.KS) said on Oct. 23 that it was notified on the night of Oct. 20 by Amadeus of indications that personal data had leaked via its systems. Amadeus is a Spain-based global IT company that supplies booking and ticketing software to airlines, hotels and travel agencies. The incident is believed to have occurred through unauthorized access that exploited login credentials assigned to an Amadeus system account. The breach is estimated to have taken place between August 2023 and September of this year, with the exact timing and circumstances still under investigation.
Information confirmed leaked so far includes Korean Air customers' booking reference numbers. However, the total number of affected individuals and the specific categories of personal data have not yet been determined. Asiana Airlines also confirmed that booking-related information was leaked through the same system, but payment-related information is understood not to be among the leaked items.
The confirmed and unconfirmed details are as follows.
Both airlines said they implemented necessary security measures immediately after being notified of the incident and that no evidence of direct intrusion into their own systems and DBs has been found. Korean Air sent customers an email on Oct. 23 informing them of the personal data breach and offering an apology, and plans to provide further notice once specific leak details are confirmed in additional investigations. It also advised customers not to open internet addresses (URLs) or attachments of unknown origin and to be wary of suspicious contacts requesting personal information.
Amadeus is reported to be investigating the circumstances and scope of the incident while carrying out follow-up measures including blocking unauthorized access and monitoring the dark web. A Korean Air official said, "We take this situation seriously and will devote all efforts to preventing additional damage and recurrence," adding, "We will conduct thorough inspections of our contracted vendors and further strengthen measures to protect customer information." An Asiana Airlines official also said, "There is no evidence of direct intrusion into our internal database, but we are implementing enhanced security measures," adding, "We will make every effort necessary to protect customer personal information to prevent additional damage and recurrence."
The timeline of the incident notification and response is as follows.
The key point of this incident is that it originated not in the airlines' own computer networks but in an external booking and ticketing system. Amadeus is infrastructure used by a substantial number of airlines worldwide for booking and ticketing operations, so the possibility that damage could spread to other airlines using the same system cannot be ruled out. Korean Air plans to demand that Amadeus strengthen security and prepare measures to prevent recurrence, while also conducting inspections of all vendors contracted to handle personal data on its behalf.
Amadeus is a major operator of global airline booking and ticketing infrastructure. It is a listed company (AMS.MC) headquartered in Madrid, Spain, with 2025 revenue of €6.517 billion, up 6.1% from the year. Its Altéa passenger service system (PSS) for airlines is used by more than 130 carriers. Its roster of major customers shows this is not a problem confined to South Korean airlines.
Japanese airlines' reliance is also growing. ANA has used Amadeus Altéa for international passenger services since 2015, and carried out work to integrate its domestic system onto Altéa from May 19 to the end of June 2026. JAL also began phased sales of NDC tickets to travel agencies in 26 countries through the Amadeus platform starting in September 2026. However, publicly available information alone does not reveal which Amadeus product was involved in this incident or whether other airlines' customer data was included. There have been no reports so far that ANA or JAL passenger information was caught up in the incident.
Concerns are emerging in the aviation industry that booking reference numbers, if combined with other information such as names and details, could lead to secondary harm such as booking changes or cancellations and retrieval of boarding information. The fact that the leak window may span as long as three years is also a factor broadening the scope of the investigation. The level of sanctions, including fines, may be determined by the findings of investigations by authorities such as South Korea's Personal Information Protection Commission, making a review of airlines' overall personal data management systems inevitable.
In South Korea, a revised Personal Information Protection Act took effect on Sept. 11, 2026, allowing fines of up to 10% of total revenue to be imposed on companies that repeatedly violate the law within three years through intent or gross negligence, or that cause a large-scale leak affecting 10 million or more people. As the scale of the leak in this incident has not yet been confirmed, it is unclear whether this provision will apply.
The full story
This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.
